Worldwide attacks on websites are linked says researcher
Domain name registration is at heart of issue
By Ellen Messmer | Network World US | Published: 05:49, 28 August 2009
Three recent SQL injection attacks appear to be under the control of the same source, according to one security researcher.
Roughly 80,000 websites in China, 67,000 in the U.S. and 40,000 in India remain compromised and under botnet control as a result of separate and ongoing SQL injection attacks. The highest infection point during the last three months reached into the millions at one point in China.
The SQL injection attacks have inserted malicious iFrames into legitimate websites in order to force visitors off them and onto dangerous malware-laden sites. Mary Landesman, senior security researcher at ScanSafe, said she believed these three waves of SQL injection attacks were likely the handiwork of the same attacker because of the similarity of the domain-name registration information and style of attack.
"It's the thread of the domain names being used," Landesman says. Seven of these "mal-domains" - a term coined by Landesman to describe domain names used solely to build Internet infrastructure to spread malware or otherwise cause harm - were registered under the same name and address (which are clearly bogus, being not more than gibberish).
These domain names are now apparently being farmed out across the world as part of the globally distinct attacks in China, US. and India.
In this case, the identified domain names were registered using bogus information provided to registrar Go Daddy, which Landesman said was "highly unusual," since Go Daddy has a generally good reputation and attackers typically prefer "domain name providers that turn a blind eye."
Go Daddy was not immediately available to comment.
But the larger problem isn't specific to any one domain-name registrar, it's the way the domain-name registration system has evolved that invites such rampant abuse. "We have a system that allows people to provide completely bogus details about who they are," Landesman said.
The openness of the domain-name registration system and lack of effective oversight has allowed criminals to exploit it to carry out Internet-based crime, she says. "It's not intentionally designed for this kind of abuse, but it works in favour of the criminals."
The system is "broken, and fixing it is the key to cutting down on these attacks," she said.
According to research from IBM, SQL injection attacks dominated web vulnerabilities in 2008.
